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We develop a notion of predicate transformer and, in particular, the weakest 
precondition, appropriate for quantum computation. We show that there is a Stone-type 
duality between the usual state-transformer semantics and the weakest precondition 
semantics. Rather than trying to reduce quantum computation to probabilistic 
programming we develop a notion that is directly taken from concepts used in quantum 
computation. The proof that weakest preconditions exist for completely positive maps 
follows immediately from the Kraus representation theorem. As an example we give the 
semantics of Selinger's language in terms of our weakest preconditions. We also cover 
some specific situations and exhibit an interesting link with stabilizers. 



1. Introduction 

Quantum computation is rapidly becoming a significant topic in theoretical computer 
science. To be sure, there still are essential technological and conceptual problems to 
overcome in building functional quantum computers. Nevertheless there are fundamental 
new insights into quantum computability (?; ?), quantum algorithms (?; ?) and into 
the nature of quantum mechanics itself (?, Part III), particularly with the emergence of 
quantum information theory (?, Ch. 12). 

These developments inspire one to consider the problems of programming general- 
purpose quantum computers. Much of the theoretical research is aimed at using the new 
tools available - superposition, entanglement and linearity - for algorithmic efficiency. 
However quantum algorithms are currently programmed at a very low level - comparable 
to classical computing 60 years ago. In the search for structure in the space of quantum 
algorithms one is led to consider issues like compositionality, semantics, type systems 
and logics; these are issues that usually arise in the context of programming languages. 
The present paper is situated in the nascent area of quantum programming methodology 
and the design and semantics of quantum programming languages. We extend the well- 
known paradigm of weakest preconditions (?; ?) to the quantum context. The influence 
of Dijkstra's work on weakest preconditions has been deep and pervasive and even led to 
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textbook level expositions of the subject (?). The main point is that it leads to a goal- 
directed program or algorithm development strategy. Hitherto quantum algorithms have 
been invented by brilliant new insights. As more and more algorithms accumulate and 
a stock of techniques start to accumulate there will be need for a systematic program 
development strategy. It is this that we hope will eventually come out of the present 
work. 

In this paper we make two contributions: first, we develop the appropriate quantum 
analogue of weakest preconditions and develop the duality theory. Rather than reducing 
quantum computation to probabilistic computation and using well-known ideas from this 
setting (?; ?), we define quantum weakest preconditions directly. It turns out that the 
same beautiful duality between state-transformer (forwards) and predicate-transformer 
(backwards) semantics that one finds in the traditional (?; ?) and the probabilistic set- 
tings (?) appears in the quantum setting. This is related to the fact that when state 
transformers are specified to be completely positive maps, we can prove the existence of 
corresponding weakest preconditions in a very general way using a powerful mathematical 
result called the Kraus representation theorem (?, Sec. 8.2.4). In fact the correspondence 
is very much more direct in this case than in the case of conventional or probabilistic 
languages. 

Second, we write the detailed weakest precondition semantics for a particular quan- 
tum programming language. Quantum programming languages have started to appear 
recently. Perhaps the best known is the quantum flow chart language (?), also referred to 
as QPL, which is based on the slogan "quantum data and classical control" . QPL has a 
clean denotational semantics and a clear conceptual basis; we give an alternative weakest 
precondition semantics for this language. It should be noted, however, that our notion 
of weakest preconditions and the basic existence results are language independent. 

The structure of this paper is as follows. In Sec. |21 the general setup, in particular 
quantum state transformers and quantum predicates, is laid out. Next, in Sec. 13 we 
define quantum weakest preconditions and healthy predicate transformers, proving their 
existence for arbitrary completely positive maps and observables. In Sec. 01 we summarize 
the basic structure of Selinger's language, and develop its weakest precondition semantics. 
We apply our results to specific situations such as Grover's algorithm and stabilizers in 
Sec. 13 and conclude with Sec. El 

2. The quantum framework 

In this section we define the main concepts on which our theory of quantum weakest 
preconditions is based. We first give a general overview, after which we specify con- 
crete definitions for quantum states and state transformers in Sec. 12.11 and for quantum 
predicates in Sec. 12.21 

Traditionally, there are several means of developing formal semantics for programming 
languages. In the operational semantics for an imperative language one has a notion of 
states, typically denoted s, such that the commands in the language are interpreted as 
state transformers. If the language is deterministic the state transformation is given by 
a function, and composition of commands corresponds to functional composition. The 
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flow is forwards through the program. This type of semantics is intended to give meaning 
to programs that have aheady been written. It is useful for guiding implementations of 
programming languages but is, perhaps, less useful for program development. By contrast, 
in a predicate transformer semantics the meaning is constructed by flowing backwards 
through the program, starting from the final intended result and proceeding to determine 
what must be true of the initial input. States are replaced by predicates p over the state 
space, together with a satisfaction relation |=. Language constructs are interpreted as 
predicate transformers. This type of semantics is useful for goal-directed programming. 
Of course the two types of semantics are intimately related, as they should be! In a sense 
to be made precise in Sec. l3.4l thev are dual to each other. The situation for deterministic 
languages can be found in the first column of Table 

In the world of probabilistic programs one sees the same duality in action, after suitably 
generalizing the notions of states and predicates. Probability distributions now play the 
role of states. There are, of course, states as before and, in a particular execution, there is 
only one state at every stage. However, in order to describe all the possible outcomes (and 
their relative probabilities) one keeps track of the probability distribution over the state 
space and how it changes during program execution. What plays the role of predicates? 
Kozen has argued (?) that predicates are measurable functions - or random variables, 
to use the probability terminology. We note that a special case of random variables are 
characteristic functions, which are more easily recognizable as the analogues of predicates; 
in fact they are predicates. In a probabilistic setting one has expectation value rather 
than truth: truth values now lie in [0, 1] rather than in {0, 1}. Third, the pairing between 
measurable functions / and probability distributions fi is now given by the integral, which 
is the probabilistic expression of the expectation value. These measurable functions are 
to be viewed as observations^ which may or may not lead to termination. The pairing 
between / and then expresses the probability with which termination is achieved when 
observing /. For probabilistic languages the second column of Table ^ summarizes the 
main concepts. 

For the quantum world we again need a notion of state - or, more precisely, probability 
distributions over possible states - a notion of predicate, and a pairing. Our choices 
are very much guided by the probabilistic case, but we are not claiming that quantum 
computation can be seen as a special case of classical probabilistic computation. Instead, 
we take density matrices as the analogue of probability distributions, while for predicates 
we take the observables of the system. These are given by (a certain restricted class of) 
Hermitian operators. Finally, the notion of a pairing is again the expectation value, but 
given by the rules of quantum mechanics; that is we have tr(M/9), where tr stands for the 
usual trace from linear algebra, p is a density matrix and M an observable. Throughout 
this paper we work with finite-dimensional Hilbert spaces and one can think of M and p 
as matrices. We discuss these concepts in more depth in Secs. l2.ll and l2.2l a summary can 
be found in the last column of Tabled Note however that, just as for the probabilistic 
case, the pairing tr(Mp) may be interpreted as the probability of termination when 
observation A'l is made in the state p. 

Why cannot one just use probabilistic predicates and the general theory of probabilistic 
predicate transformers in a quantum context? The following simple example - due to one 
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Table 1. Comparing situations. 
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satisfaction 


expectation value 


quantum expectation value 


s\=p 
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of the referees - illustrates why. Suppose that we have a two-dimensional Hilbert space 
of states with basis vectors written |0) and Two other states in this Hilbert space 
are -^(|0) + |1)) and -^(10) — |1)). We use the notation for the density matrix 

|^/^)('!/'| and write convex combinations like A{|'0)} + (1 — for the density matrix 

of a mixed state, i.e. an ensemble. Now consider the measurable function / defined by: 



/(|0)) = 

/(|i)) = o 

/(i=(|0) + |l))) = l (1) 
/(-^(|0)-|1)) = 1. 

This function is indeed measurable but not linear and cannot correspond to any kind 

of physical observable or measurement. To sec what happens, consider the ensemble 
p=i{|0)} + i{|l)}. When / is applied to this one obtains 0. However, when / is applied 
to the ensemble p' = ^{-^{\0) + \l))} + ^{-^{\0)-\l))} we obtain the value 1. The point 
is that p and p' are physically indistinguishable, and thus one cannot have a physical 
observable that tells these "two" ensembles apart. When developing a theory of predicates 
and predicate transformers one must therefore restrict to mathematical objects that are 
compatible with the linear structure of quantum mechanics. It is a conceptual error to 
think that quantum mechanics c;an be understood just with probabilistic constructs. 
We note that the work in (?), which uses probabilistic predicates to analyze Grover's 
algorithm (?), avoids this conundrum because it considers only pure-state situations. 



2.1. Quantum states and state transformers 

Typically a quantum system is described by a Hilbert space, physical observables are 
described by Hermitian operators on this space and transformations of the system are 
effected by unitary operators (?). However, we need to describe not only so-called pure 
states but also mixed states. These arise as soon as one has to deal with partial infor- 
mation in a quantum setting. For example, a system may be prepared as a statistical 
mixture, it may be mixed as a result of interactions with a noisy environment (deco- 
herence), or by certain parts of the system being unobservable. For all these reasons we 
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need to work with probability distributions over the states in a Hilbert space. In quantum 
mechanics this situation is characterized by density matrices, of which a good expository 
discussion appears in (?, Ch. 2). Concretely, a density matrix p on a Hilbert space Ti 
is a positive operator, that is, for all states |a;) in Ti one requires that {x\px) > 0, with 
furthermore tvp < 1 . The reason why we do not have the usual equality is that we do not 
assume that everything is always normalized. Hence, in order to interpret a density ma- 
trix as a probability distribution one first needs to renormalize if necessary. This is a bit 
of a nuisance if one wants a direct interpretation of the density matrix at every stage of 
the computation; however, one does recover the probabilities correctly if one starts with 
a normalized density matrix at the start of a computation and multiplies out everything 
at the end. This convention saves some notational overhead and is used by Selinger (?). 
We denote the set of all density matrices over a Hilbert space H by VMiTL). 

As we have mentioned in the above, forward operational semantics is described by 
quantum state transformers. The properties of such state transformers are now well 
understood. A physical transformation must take a density matrix to a density matrix. 
Thus it seems reasonable to require that physical operations correspond to positive maps, 
which are linear maps that take a positive operator to a positive operator. However, it is 
possible for a positive map to be tensored with another positive map - even an identity 
map - and for the result to fail to be positive. Physically this is a disaster. Indeed, this 
means that if we formally regard some system as part of another far away system which 
we do not touch (that is, to which we apply the identity transformation), then suddenly 
we have an unphysical transformation. A simple example is provided by the transpose 
operation, which is a positive map while its tensor with an identity is not. Therefore, 
we need the stronger requirement that physical operations are completely positive, a 
property which is defined as follows. 

Definition 2.1. A map £ is completely positive when it takes density matrices to density 
matrices, and likewise for all trivial extensions I ® £. 

Note that such a map may operate between distinct Hilbert spaces, that is in general we 
have £ : VMiHi) VM('H2)- We denote by C'P{ni,H2) the set of ah such maps, and 

write cv{n) for cv{n,n). 

We frequently rely on the Kraus representation theorem for completely positive maps. 

Theorem 2.1 (Kraus Theorem). The map £ : VMiHi) VM{n2) is a completely 
positive map if and only if for all p € VMiJii) we have that 



for some set of operators {Ei : Tii — > Ti.2}, with EjEi < I. 

The condition on the Ei ensures that trace of the density matrix never increases. Eq.Q is 
also known as the operator-sum representation. The proof to this theorem can be found, 
for example, in (?, Sec. 8.2.4). Note there is nothing in the theorem that says that the 
Ei are unique. 
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2.2. Quantum predicates 

In this section, we define quantum predicates and the associated order structure required 
for the development of our theory. Concretely, we need an ordering on predicates so as 
to define weakest preconditions, and this order should be Scott- continuous in order to 
deal with programming language aspects such as recursion and iteration. 

As argued above, quantum predicates are given by Hermitian operators. However, 
general Hermitian operators will not yield a satisfactory logical theory with the duality 
that we are looking for. We need to restrict to positive operators and - in order to obtain 
least upper bounds for increasing sequences - we need to bound them. More precisely, 
wc have the following definition. 

Definition 2.2. A predicate is a positive - hence Hermitian - operator with the maximum 
eigenvalue bounded by 1. 

The reason for taking predicates to have the maximum eigenvalue bounded by 1 is in 
order to get a complete partial order (CPO); we clarify this below. Since our predicates 
are positive operators their eigenvalues are real and positive. We denote the set of all 
predicates on a Hilbert space H by P{'H). 

Proposition 2.1. For any density matrix p and Hermitian operator M we have < 
tr(Mp) < 1 if and only if M is positive and its eigenvalues are bounded by 1. 

Proof. Note that for any element of H wc have tT{M\ip){ip\) = (■;/' | M | -0). Assume 
that < tr(Mp) < 1 for any p a density matrix. Choose p = where is an 

arbitrary normalized vector. We have < ti{M\ip){ip\) = {ip \ M \ ip), which says that 
M is positive. Now choose to be a normalised eigenvector of M with eigenvalue A, 
necessarily real and positive, so we have that tr ( M Itjj) ~ {t/j \ M \ ijj) = X{tjj\tjj) = 
A < 1. Thus the eigenvalues are bounded by 1. The converse is obvious once we note that 
any density matrix is a convex combination of density matrices of the form |V')(V'I- CH 

Thus wc could have defined predicates as positive operators M such that for every 
density matrix p we have < ti{Mp) < 1. This exhibits the predicates as "dual" to 
density matrices. 

We define an ordering as follows. 

Definition 2.3. For matrices M and N in C"^" we define M QN iiN-M is positive. 

This order is known in the literature as the Lowner partial order (?). Note that this 
definition can be rephrased in the following way, where VAdCH) denotes the set of all 
density matrices. 

Proposition 2.2. M C TV if and only if Vp e VM{n).tv{Mp) < tT{Np) 

Proof. Indeed, N ~ M positive means that for all x G 7i we have (a;|A^ — M\x) > 0, 
or, equivalently, tr((A^ — M) .\x) {x\x) > 0. By linearity of the trace and the fact that the 
spectral theorem holds for all p G T>M{H) we obtain the desired result. For the converse. 
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take all pure states p = \x){x\. Then we find that for al\x E H wc have {x\N — M\x) > 0, 



Put otherwise, M \Z N if and only if the expectation value of N exceeds that of M. 
With the above definitions, we have the following result. 

Proposition 2.3. The poset {ViTi,), C) is a complete partial order (CPO), i.e. it contains 
least upper bounds of increasing sequences. 

Proof. Take an increasing sequence of predicates Mi C M2 C . . . IZ Mi C . . .. This 
is a sequence of positive operators with trace bounded by 1, or in other words, density 
matrices. Since {T>Ai{H), C) is a CPO (?), this sequence has a least upper bound M. It 
follows that (Vin), C) is a CPO. □ 
Taking predicates to be bounded Hermitian operators leads to Prop. 12.31 which guaran- 
tees the existence of fixpoints and thus allows for the formal treatment of iteration and 
recursion in Sec. 01 

3. Quantum weakest preconditions and duality 

In this section we elaborate our theory of quantum weakest preconditions. We first give 
the main definitions in Sec. 13. II after which we explore healthiness conditions in Sec. 13.21 
Next, we investigate weakest precondition predicate transformers for completely positive 
maps in Sec. 13.31 With the latter results we obtain a duality between the forward state 
transformer semantics and the backward weakest precondition semantics in Sec. 13.41 

3.1. Definitions 

In a quantum setting, the role of the satisfaction relation is taken over by the expectation 
value of an observable M, just as for probabilistic computation. The quantum expectation 
value of a predicate M is given by the trace expression tr(il/p). Preconditions for a 
quantum program Q - described in an unspecified quantum programming language - 
are defined as follows. We write Q for the program as well as for the trace-nonincreasing 
completely positive map that it denotes. 

Definition 3.1. The predicate M is said to be a precondition for the predicate N with 
respect to a quantum program Q, denoted M{Q}N, if 



We also introduce the notation p [=r M to mean that tr{Mp) > r. Thus we think of this 
as a quantitative satisfaction relation with the real number r providing a "threshold" 
above which we deem that p satisfies M. 

The exact syntax of the quantum program Q is left unspecified deliberately, as we want 
to state these definitions without committing to any particular framework. Of course we 
expect Q to implement at least some transformation on density matrices, in particular we 
may think of Q as implementing a completely positive map. Note however, that Def. 13. l| 



or in other words M Q N. 



□ 



Vp e VM{n).iv{Mp) < tY{NQ{p)) 



(3) 
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as well as Def. 13.21 below, does not exclude other possibilities. For example we could 
also investigate possibilities proposed in (?), where it is argued that positive but not 
completely positive or even not positive maps are also good candidates for describing 
open quantum evolutions. 

This definition deserves motivation. If all density matrices were normalized then it is 
easy to motivate Def. 13.11 if we want the expectation value of N in the state Q{p) to 
be above some real number r, say, then this is guaranteed if the expectation value of 
M in the state p is above r. In the case of our unnormalized density matrices we have 
to do a little calculation to see that the same holds. We write the expectation value of 
M in a state (density matrix) p as {M)p. Now we assume that M, N and Q satisfy the 
conditions of Def. 13.11 Let p be any (unnormalized) density matrix and let its normalized 
version be p = /5/tr(p). Then we have 



(M)p = tr(Mp) 
1 



trip) 



tr(Afp) 

(4) 



< • tr{NQ{p)) 



tr(p) 

tr(g(p)) 1 

tr(p) ■ tr(Q(p)) 
tr(Q(p)) 



tr(iVQ(p)) 



tr(p) 



{N)qp 



Thus, even though the density matrices are not normalized and we cannot read the 
expectations directly at every intermediate stage, Def. 13.11 still has the same import as 
in the normalized well as in the case of probabilistic predicate transformers. 

From this we define weakest preconditions in the usual way. 

Definition 3.2. A weakest precondition for a predicate M with respect to a quantum 
program Q, denoted wp(Q)(M), is such that for all preconditions L{Q}M implies L C 
wp(Q)(M). 

Note that weakest in this context is equal to largest; indeed, a larger predicate means 
that Eq.© holds for more initial states p, and thus corresponds to a weaker constraint. 
The weakest precondition predicate transformer for a program Q, if it exists, is denoted 
wp(Q) : V{T-L2) — > V{Ti.i), where H2 and Hi are the output and input Hilbert spaces 
respectively. 



3.2. Healthiness conditions 

In analogy with (?), we want to formulate healthiness conditions for quantum predicate 
transformers. These are important because they characterize exactly those programs 
that can be given a weakest precondition semantics which is dual to its forwards state 
transformer semantics. Moreover, healthiness conditions allow one to prove general laws 
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for reasoning about programs. The healthiness conditions we propose for the quantum 
case are linearity and complete positivity, leading to the following definition. 

Definition 3.3. A healthy predicate transformer a : 7^(7^2) ^{Tii) is a predicate 
transformer that is linear and completely positive, i.e. it it takes predicates to predicates 
and likewise for all trivial extensions / (g) a. We denote the associated space of healthy 
predicate transformers as VT{H2,'Hi). 

As we shall see in the following section these conditions all hold in the framework 
where quantum programs correspond to completely positive maps. Linearity is certainly a 
requirement in the inherently linear context of quantum mechanics, as the example given 
in Sec.|21clearly shows. Just as in the probabilistic case (?), hnearity imphes the analogues 
of some of the healthiness conditions for deterministic programs, namely feasibility, which 
means that wp(Q)(0) — 0, monotonicity and continuity. These proofs are easy and are 
left to the reader. The requirement that predicate transformers should be completely 
positive on 7'(7i), is a very natural one. Indeed, if a is a predicate transformer, which 
acts only on part of a composite Hilbert space Ti., then composing it with the identity 
predicate transformer working on the rest of the Hilbert space should still result in a 
valid predicate transformer. 

We equip VT{Ti.2,'Hi) with an order structure by extending the Lowner order on 
predicates in the following way. 

Definition 3.4. For healthy predicate transformers a and /3 in 'PT{'H2,'Hi) we define 
aC/3if/3 — aisa healthy predicate transformer. 

If a C /3 then for all predicates M e 'P(7^2) we have that a{M) C /3(M), where a{M) 
and f3{M) are predicates on Tii. Requiring only this would be the obvious extension 
of the Lowner order, however, since we are working in the space of healthy predicate 
transformers we also need to demand that P — a is completely positive. That is, for all 
extended predicates Me eV{n2<^ H) we have (a (g) In) {Me) C (/3 In) {Me). We then 
have the following result. 

Proposition 3.1. The poset {VT{H2,Hi),Q) is a CPO. 

Proof. Take an arbitrary increasing sequence of predicate transformers 

ai C 0^2 C • • • C C ■ ■ • • 

This is in fact a sequence of completely positive maps. Hence since (C7'(7ii, 7^2), is a 
CPO (?), this sequence has a least upper bound a. It follows that {VT{H2,'Hi), C) is a 
CPO. □ 

Note that the CPO structure as defined on predicates 'P{TL) and associated predicate 
transformers VT{T-L) is identical to that for density matrices T>M{Ti) and associated 
completely positive maps C'P{'H), as defined in (?). 

Furthermore, for healthy predicate transformers, we have the following immediate con- 
sequence of Kraus's theorem. 
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Proposition 3.2. The operator a is a healthy predicate transformer if and only if one 
has that 

VAf e V{n).a{M) = AlMAu (5) 

u 

for some set of linear operators {Au] such that A^A^ < I. 
3.3. Predicate transformers for completely positive maps 

Let us now consider the following framework: the forward semantics of a quantum pro- 
gram Q is given by a trace-nonincreasing completely positive map £ G CV{7ii,TL2), 
which we write as \Q\ = £. In this section we prove an existence theorem of weakest 
preconditions for completely positive maps, and show that they satisfy the healthiness 
conditions given in Sec. 13.21 i.e. that they are healthy predicate transformers. 

Proposition 3.3. \/£ e C7'(7^i,7^2) and N e ViH), wp{£){N) exists and is unique. 
Furthermore, we have that 

Vp.tr(wp(£:)(iV)p)=tr(Ar£:(p)) (6) 



Proof. 

To prove existence, take an arbitrary predicate N and operation £. From the Kraus 
representation theorem stated in Sec. 12.11 one has for every operation £ that 



£{p)=Y,E.npEl (7) 

m 

with E^E„i < I. Using this, together with the fact that the trace is linear and 
invariant under cyclic permutations, we obtain for a predicate N that 



tv{N£ip))^tv{{J2ElNE,^)p) (8) 

m 

If we then take 

M^J2^^n^NE^ (9) 
m 

in Eq.®, we obtain 

Vp.tr(Afp) = tr{N£{p)) (10) 

So M is a precondition for A'' with respect to £. Now take any other precondition M' for 
N with respect to £. In other words 

Vp.tr(MV) < tT{N£{p)) (11) 

but because of Ea. ((Tn|l and Prop. this imphes that M' C M. So M is the weakest 
precondition for N with respect to £, denoted wp(£)(iV). 
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To prove uniqueness, suppose the predicate P is also a weakest precondition for N 
with respect to £. Then we have M Q P, but also, since M is a weakest precondition, 
P CI Af . But then, since C is an order, we have M = P. D 

From Eq.® and Prop. we obtain the following. 

Corollary 3.1. For aU £ e CViH), wp(£) e VTiH), i.e. it is a healthy predicate 
transformer. 

3.4. Duality 

In this section, we investigate the duality between the forward semantics of completely 
positive maps as state transformers, and the backwards semantics of healthy predicate 
transformers. This duality is part of a web of dualities known to mathematicians as Stone- 
type dualities (?), the prototype of which is the duality between boolean algebras and 
certain topological spaces called Stone spaces. For readers with a background in category 
theory we note that such a duality is captured by an adjoint equivalence mediated by 
a pairing, for example the satisfaction relation between states and predicates. Kozen - 
following suggestions of Plotkin - found such a duality in the context of probabilistic 
programs (?). We show that such a duality exists in the quantum setting as well. 

In the quantum context, we find the duality by defining an isomorphism between 
the set of all completely positive maps C7^ (7^1,7^2) and the set of all healthy predicate 
transformers VT{Ti2,'Hi). We can associate a healthy predicate transformer with every 
operation £ e CV{Hi,H2)', this follows immediately from Prop. rOI Indeed, we asso- 
ciate with every operation £ its weakest precondition predicate transformer wp(f ). To 
complete the duality, we need to associate an operation A G C'P{Ti. 1,0.2) with a predi- 
cate transformer a £ VT{H2,'Hi). Using the operator-sum representation for predicate 
transformers as given in Eq.(|31), wc have that 

tr(a(M)p)=tr((^AtM^„)p) 

U 

= tr(M.(^A„pAt) (12) 

U 

If we then take 

^(p)=^^„pAt (13) 

we obtain 

tr(a(M)p) = tT{MA{p)) (14) 

thus associating a state transformer with every healthy predicate transformer. Analo- 
gously to the above, one could say that this expression defines the "strongest post-state" 
A{p) for a state p, with respect to a predicate transformer a E VT{H). 

To see this as a duality more clearly, we use the notation p M defined in Sec. |3| 
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Then we have 

It is straightforward to sec that wo have an order isomorphism between the domain of 
predicate transformers 'PT{Ti.2,'Hi) and the domain of state transformers CV{'Hi,'H2), 
and this for arbitrary Hilbert spaces Hi and H2- As an aside we note that because of 
this and the fact that maps in ■PT(W2j Wi) are Scott-continuous, we immediately obtain 
that healthy predicate transformers are Scott-continuous as well. 



4. Weakest precondition semantics for QPL 

The quantum flow chart language or Quantum Programming Language (QPL), is a 
typed programming language for quantum computation with a formal semantics, which 
is built upon the idea of quantum data and classical control (?). It is very different 
from previously defined quantum programming languages, which do not have a formal 
semantics and are imperative rather than functional. Syntactically, programs in QPL are 
represented either by flow charts or by QPL terms. The basic language constructs are 
allocating or discarding bits or qubits, assignment, branching, merge, measurement and 
unitary transformation. One can then build more complex programs from these atomic 
flow chart components through context extension, vertical and horizontal composition, 
iteration and recursion. 

At each moment the denotation of the system, called a state in (?), is given by a tuple 
of density matrices. The tuple dimension originates from classical bits present in the pro- 
gram, while tuple entries represent the state of all available qubits as density matrices. 
Each member of the tuple corresponds to a particular instantiation of the classical vari- 
ables in lexicographical order; this is otherwise interpretc;d as a classical control path. 
Concretely, a state for a typing context containing n bits and m qubits is given by a 
2"-tuple {po, ■ ■ ■ , P2"-i) of density matrices in VM{C^"^). Program transformations are 
given by tuples of trace-decreasing completely positive maps which act on states - these 
are called supcropcrators in (?). Note that positivity on tuples is defined such that it 
holds for each entry, while the trace of a tuple is defined as the sum of the traces of its 
entries. 

The formal semantics of QPL is developed within the category Q, which has signa- 
tures (which define tuples of complex finite-dimensional vector spaces) as its objects and 
superoperators as its morphisms. This category is equipped with a CPO-structure, com- 
position, a coproduct ® and a tensor product (g), all of which are Scott-continuous, and 
a monoidal trace Tr. The latter is just the categorical trace for the co-pairing map ®; as 
per (?) we use the term monoidal to avoid confusion with the categorical trace for the 
tensor product, i.e. the matrix trace tr. The coproduct ® denotes concatenation of signa- 
tures. Note that, unlike the very similar situation of finite-dimensional vector spaces, it is 
not a product, as © does not respect matrix traces and hence is not a superoperator. All 
basic fiow chart components are morphisms of this category. For example, the semantics 
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of measurement of one qubit qis defined as 

[measure qj : qbit qbit qbit : p {£q ® £i){p) = PopPo ® PipPi , (16) 

where = Context extension is modeled by specific or operations on the 

state. Vertical and horizontal composition correspond to composition and coproducts of 
morphisms respectively, while iteration is interpreted via the monoidal trace. Specifically, 
suppose that an operation £ : cr r ^ ct' r, where cr, a' and t are signatures, has been 
decomposed into components Su : a ^ a' , £12 : a ^ t, £21 '■ t ^ a' and £22 : t ^ t. 
The operation obtained from £ by iterating over t is then given by the monoidal trace 
of £, defined as 

00 

TV(f)=£:n+^£2i;f^2;^i2 • (17) 

i=0 

The existence of this limit is ensured by the CPO structure on superoperators (?). 

QPL also allows recursively defined operations £ — F{£), where F is a fiow chart. 
In this case, F defines a Scott-continuous function <i>i? on morphisms, such that the 
interpretation off is given as the least fixed point of ^p. Concretely, 

£=U,Fi with Fo = and F,+i = $i.(P,) (18) 
= U,$5.(0), (19) 



where is the zero completely positive map, which corresponds to the divergent program. 
Again, the existence of these fixed points is ensured by the CPO structure. 

In what follows we derive a weakest precondition semantics for QPL. Note that in 
order to to this, our predicates need to operate on tuples of density matrices. We do this 
by writing expressions of the type Mi M2 where Mi and M2 are predicates in the sense 
of Def. 12.21 This works since is in fact defined on arbitrary linear maps. We frequently 
write wp(Q) instead of wp(|Q]); by this we mean that we use the forward semantics of Q, 
which is given by a tuple of completely positive maps, to derive the weakest precondition 
predicate transformer for Q according to the results in Sec. 13.31 

Basic flow charts. In our approach we uniformly consider all basic flow charts to be 
operations in the operator-sum representation as in Eq.jT)). As such Prop. 1^751 alreadv 
provides a weakest precondition semantics for these atomic flow charts. Note, however, 
that predicates need to be defined in accordance with the type of the tuple exiting a 
basic flow chart. As a concrete example, we mention measurement, for which the forward 
semantics is specified in Eq. (|16|) . We find that for all predicates Mi M2 we have 

wp(measure g)(Mi M2) = wp{£n £i){Mi M2) 

= wp(£o)(Afi) + wp(£i)(Af2) (20) 

= PoAfiPo + P1M2P1 . 

We now turn towards weakest precondition relations for composition techniques of 
QPL. 
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Fig. 1. Sequential composition schematically. 



Sequential composition. Suppose we take the sequential composition of two operations 
£i and £2, as shown in Fig. ^ For the composed operation £i;£2 and for all predicates 
M we have that 



tr(A/.(£i;£2)(p)) = tr(wp(£i; £2)(Af).p) 



(21) 



If we calculate weakest preconditions for both operations separately and then compose 
them sequentially, we obtain 



tr(M.(£i;£2)(p)) = tr(M.£2(f i(p))) 

= tr(wp(f2)(M).fi(p)) 
-tr(wp(fi)(wp(f2)(M)).p) 
= tr((wp(f2);wp(fi))(M).p) 



(22) 



Hence by Eas. (|21(l and H22|l we obtain that weakest predicate transformers compose 
sequentially as follows, 



wp{£i;£2) = wp(£:2); wp(fi) 



(23) 



This is the same rule as one finds for sequential composition in classical programming 
languages (?). 



Parallel composition. Suppose we take the parallel composition of two operations £1 and 
£2, as shown in Fig. [3 For the composed operation £1 © £2 we have that 



tr((Mi ® M2).{£i ® £2){pi © P2)) = tr(wp(£i ® £2){Mi © A^2).(pi © P2)) ■ (24) 
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Fig. 2. Parallel composition schematically. 



On the other hand, if we calculate weakest preconditions for both operations separately 
and then compose them in a parallel way, we obtain 

tr((Mi e M2).{£i e £2)ipi © P2)) - tr(Mi.fi(pi) M2.f2(p2)) 

= tr(Mi.fi(pi)) + tr(M2.f2(p2)) 

= tr(wp(£i)(Mi).pi) + tr(wp(£2)(Af2).p2) (25) 

= tr((wp(£i)(Mi) ® wp(£2)(M2)).(pi © P2)) 

= tr((wp(£:i) e wp(£:2))(Mi e M2).(pi e P2)) • 

Comparing Eas. H24(l and H25|l wc obtain that for parallel composition weakest precondi- 
tion predicate transformers compose as follows, 

wp(fi ® £2) = wp(f 1) ® wp(£:2) (26) 



Context extension. Let us now study what occurs if we weaken a context with dummy 
classical or quantum variables. Suppose first that we have a QPL program Q with deno- 
tation £. We first modify Q by picking a fresh classical variable b and adding it to Q's 
context; denote the resulting program Qf,. The forward semantics of the latter is given 
by £ (B£ (?), and hence by Eq.ljSEI) we find that 

wp(Qb) = wp(Q) © wp(Q) . (27) 

Suppose next that we add a fresh qubit q to Q's context, and write Qq for the resulting 
program. The forward semantics of Qq is given by 

Pi I P2 \ / £{pi) I £{P2) 
m\ = 1- (28) 

P3 I P4 / V £{P3) I £{P4) 



which we write more concisely as 



Accordingly, we find that 



£ I £ 

m = I 1 . (29) 

£ I £ 



wp(£) I wp(£) 

wp(Q,) = I 1 . (30) 

wp{£) wp{£) 
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Fig. 3. Iteration schematically. 



Iteration. Consider a flow chart which is obtained from a program Q by introducing a 
loop. As explained in the above, the semantics of the flow chart is given by the monoidal 
trace Tr(£), where £ is the semantics of the flow chart obtained from Q by removing the 
loop. For a predicate M we have that 



tT{M.{Tri£)){p)) = tr(wp(TV(£))(M).p) 
By iterating explicitly and using Eas. lfrzjl and we obtain 

tr(Af.(TV(£))(p)) 

OO 

= tr(Af.(fn+5]f2i;f^2;^i2)(p)) 



= tr (M.f n {p)) + J2 (^21 ; ^22 ; ^12 ) (P) ) 

4=0 

OO 

= tr(wp(£n)(M).p) +^tr((wp(£i2);wp(£22)';wp(£2i))(M).p) 

i=0 

oo 

= tr((wp(£ii) + ^ wp(£i2); wp(£22)';wp(£2i))(M).p) . 

1=0 

Comparing Eqs.(j2U and l|32|l we obtain that 

oo 

wp(Tr(£)) = wp(£ii) + ^wp(£i2); wp(f22)*; wp(£2i) ■ 
Moreover, the existence of the limit in Ea. (|33|l is guaranteed due to Prop. ITTl 



(31) 



(32) 



(33) 



Recursion. Consider an operation which is defined recursively, i.e. an operation £ satis- 
fying the equation £ — F{£), where is a flow chart. The required flxed point solution 
to this recursive equation is given by Eas. l|18|l and l|19|) . If we work out the weakest 
precondition relations using Ea. (|18|l and the fact that weakest precondition predicate 
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transformers are Scott-continuous we obtain 

tr{M£{p)) =. tr(Af.(U,F,)(p)) 

= tr(wp(U,i^,)(M).p) (34) 
= tr((U,wp(F,))(Af).p) . 

Combining this result with Prop, we find that the weakest precondition predicate 
transformer for a recursively defined operation £ = F{£) is obtained as 

wp(£) = U,wp(i^,) = U,wp($5,(0)) . (35) 

The existence of the least upper bound in Ea. H35|) is guaranteed by Prop. 13.11 This 
result depends of course on the concrete recursive specification considered. Specifically, 
one needs to determine in order to determine the weakest precondition predicate 
transformer corresponding to an operation £, defined recursively as £ = F{£). 



5. Applications 

In this section we look at some specific situations and their weakest precondition predicate 
transformers. 



5.1. Grover's algorithm 



We first look into Grover's algorithm, also known as the database search algorithm (?). 
The algorithm is parameterized by the number of qubits n and is specified in QPL as 
follows, where we write N for 2". 



1 



El 



Grover{N) ::= new qintn q '■= 
new int n := C ; 

while C > do (36) 

= G ; 
C;=C-1 ; 
measure q 

Note that we assume the presence of product types of quantum integers qintn - qubit 
registers of size n - and integers int, which were elaborated in (?), and also the presence 
of integer operations. 

The Grover operator G is given by 



G = 0\ I AM 



(37) 



where O is a quantum oracle, which labels solutions to the search problem, and I AM is 
the inversion about mean operation, specifically I AM = Tl!i=o I*) 01 ~ I- 

Supposing the solution to the search problem is given by s, then the relevant postcon- 
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dition for Grover is given by ®^o^ particular we wish to obtain 



tr(0k)(s|p/J = l, (38) 



j=0 



where ^^q^ Pfi final state of the algorithm, and the tuple summation is present 

due to measurement branching. 

We work our way backwards through the algorithm using Ea. H23|l in order to find the 
weakest precondition corresponding to the postcondition ®^q^ First we derive 

the weakest precondition for the measurement in the last step of the algorithm. We do 
this according to a generalization of Ea. H20l) for A^- valued measurements, as follows. 

JV-l N-l 

wp(measure g)(0 \s){s\) = wp(fo © ■ • ■ © ^w-OlQ \s){s\) 

1=0 i=0 

= wp(£o)(|s>(s|) + • • • + wp(£jv-i)(|s>(s|) (39) 
= Po\s){s\Po + ■■■ + Pn-i\s){s\Pn-i 
= \s){s\ . 

Note that, since the remainder of the algorithm consists of unitary evolution, all relevant 
preconditions continue to be pure state projectors. In this case Ea. (l38|l holds only if the 
output state equals the predicate, that is if pf = |s)(s|, so that pure state precondi- 
tions are at the same time the states required for the algorithm to satisfy Ea. H38|l after 
termination. 

We now focus in the while loop in the algorithm. Geometrically, the Grover operator 
is a rotation in the two-dimensional space (?, Sec. 6.1.3) spanned by the states \s) and 



More specifically, G can be decomposed as 



/COS. -sine\ ,,,,^2ViV3T 

\sme cose J N ^ ' 

Applying again Eq. H23() , we obtain as weakest precondition with respect to the while loop 
the following. 



wp(while C> do = G)(|s)(s|) = {G^)\s){s\G^ , (42) 

where we omit explicit weakest precondition reasoning for the purely classical command 
C := C —1. Using Ea. (|^ . we see that {G'^y\s) corresponds to C rotations over an angle 
of —9 in the state space spanned by \a) and \s). By choosing C = arccos (?, Sec 
6.1.3), one rotates the postcondition \s){s\ towards the precondition \'ipi){ipi\, where lipi) 
is the initial state of the algorithm, i.e. the equal superposition state, which lies in the 
space spanned by the states \a) and \s). In other words, using Eq.© and Ea. lpIHjl we 
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obtain that for all pi 



ti{wp{Grover){\s){s\)pi) — tr{\s) {s\Grover{pi)) 
^ tr(|V',)(^,|p,) = 1 . 



(43) 



That is, Ea. (|38() holds if and only if pi = \il'i){tpi\ which is the case by construction of the 
algorithm. Hence we have established the correctness of the algorithm via our backwards 
semantics. 

We note that an alternative derivation for Grover's algorithm based on probabilistic 
weakest preconditions has been reported in (?). However, the use of probabilistic no- 
tions only works there because Grover's algorithm is considered for pure states only. The 
mathematical structures underlying their analysis is that of probabilistic weakest precon- 
ditions, which are in fact not suited at all for a generalized quantum setting, as we have 
stressed in Sec. |2 In our setting we could reason about mixed state solutions to Grover 
and compare them with the pure state solution elaborated in the above. Also, while it 
may seem at first sight that in (?) the value of C is derived via the backward semantics 
this is in fact not the case. Instead, a recurrence relation for amplitudes occurring in each 
Grover iteration is solved; these amplitudes are found by applying the Grover iteration 
backwards, just as we did. We chose to adhere to the interpretation of G as a rotation 
in a two-dimensional state space in order to find C; we could just as well have adhered 
to the derivation in (?). While their proof is an ingenious alternative to that in (?), it is 
not based on the theory of probabilistic weakest preconditions. 



5.2. Tossing a coin 

As a second application, we derive the weakest precondition for the flow chart imple- 
menting a fair coin toss (?, Example 4.1). In QPL terms the flow chart is specified as 
follows, where r is an input qubit register of unspecified length. 



An arbitrary postcondition for this program is of the form Mi © M2, where Mi and 
M2 are both predicates over 7^(0^") and n is the number of qubits in the register r. 
We derive the corresponding weakest precondition by flowing backwards through the 
program, starting with the discard operation. The latter induces the following quantum 
operation, where In is the (N x N) identity map with iV = 2" as before, denotes the 
{N X N) zero block matrix, and p is a density matrix in PA^(C^'^"+^^), 



coin{r) new qbit q :~ 0; 



(44) 



measure q; 



discard q 




(45) 
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This leads to the foUowing weakest precondition, 

Afi I \ / I 

wp(discard q){Mi © M2) = \ ® | . (46) 

I / V I M2 

Next, we have the measurement step. We just give the result here, as this type of deriva- 
tion was already encountered in the Grover example above. 

Af 1 I \ / I \ / Ml I 

wp (measure I ® 1= I " ^'^^^ 

I / V I Af 2 / V I A/2 

The Hadamard transformation is straightforward and leads to 

Af 1 I \ / HMiH I 

wp(g* = H) I = I . (48) 

I Af 2 / V I HM2H 

Finally we move through the first command in the coin toss program, namely the addition 
of a new qubit. The forward semantics of this command is as follows, where p is a density 
matrix in VMiC^"-), 

( In 

[new qbit q := Q\[p) = ( ) p ( f at | ) . (49) 

Hence, we obtain the following, 

/ HMiH I 

wp(new qbit <? := 0) [ | = HMiH . (50) 

V I ifAf2ff 

Wrapping all individual steps of the coin toss program up into one weakest precondition 
predicate transformation according to Ea. (|23|l we obtain 

wp(com(r))(A/fi © M2) = HMiH . (51) 



5.3. Stabilizers are predicates 

The stabilizer formalism is an alternative description of quantum states (?). Instead 
of describing states as vectors in a suitable Hilbert space, they are described by a set 
of operators which leave the state invariant. Concretely, for an n-qubit system these 
operators are taken from the Pauli group Gn, i-e. the group of n-fold tensor products of 
the Pauli matrices with factors ±1, ±i in front. Note that if we allow all positive operators 
instead one obtains the more familiar density matrix formalism. Of course not all states 
can be described in this way. Formally, a stabilizer state is a simultaneous eigenvector of 
an abelian subgroup of the Pauli group with eigenvalue 1. This subgroup is then called 
the stabilizer S of this state, and usually represented by its generators. Surprisingly, some 
forms of entanglement, such as graph states for example (?), as well as all Clifford group 
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operations, can be described efSciently via stabilizers - a celebrated result known as the 
Gottesman-Knill theorem (?, Sec. 10.5.4). This is because for an n-qubit stabilizer state 
its stabilizer S has n—1 generators (as opposed to 2" amplitudes in the state formalism). 
A nice overview of stabilizer theory can be found in (?, Ch. 10). 

Stabilizers, which are unitaries, fit well within the setting of weakest preconditions, 
because when restricting ourselves to pure states, they are in fact quantum predicates. 
This follows from the following theorem. 

Proposition 5.1. Given a pure state p = \il)){ip\ and a unitary U we have that 

tr(C/p) = 1 ^ U\^) = IV^) (52) 



Proof. For the left to right direction, we have that 

tr(C/|V')(^|) ^{^\U\^)^1 

^|^)-C/|^)=0 

^ 1^) = u\^) . 

The other direction is obvious. □ 
For example, consider the creation of a Bell state \B) = ^^^^jd'^'*''' by applying U = 
CNOT.{H®I) to 1 00). The stabilizer of \B) is generated by Z1Z2 and X1X2. Hence by 
the above result we have iT{ZiZ2Su{\ip){tli\)) = tr(XiX2£c/(IV')(V'l)) = Ij where \ip) is 
the initial state of the algorithm and £u{p) = UpU'' for all p. Applying Eq.©, we obtain 
as weakest preconditions wp{£u){ZiZ2) = Z2 and wp{£u){XiX2) — Z\. By Prop. ^01 
we thus also have tr(Zi|-0)('0|) = tr(Z2|'0)('0l) — 1- But then by the above result Z\ and 
Z2 are stabihzers of 1-0). Hence IV') = |00), as required. 



6. Conclusions 

In this article, we have developed the predicate transformer and weakest precondition 
formalism for quantum computation. We have done this by first noting that the quantum 
analogue to predicates are expectation values of quantum measurements, given by the 
expression tr(Mp). Then we have defined the concept of weakest preconditions within this 
framework, proving that a weakest precondition exists for arbitrary completely positive 
maps and observables. We have also worked out the weakest precondition semantics for 
the Quantum Programming Language (QPL) developed in (?). QPL is the first model 
for quantum computation with a denotational semantics, and as such the first serious 
attempt to design a quantum programming language intended for programming quantum 
algorithms compositionally. 

With this development in place one can envisage a goal-directed programming method- 
ology for quantum computation. Of course one needs more experience with quantum 
programming idioms and the field is not yet ready to produce a "quantum" Science of 
Programming. It is likely that in the field of communication protocols, such as those 
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based on teleportation, we have a good stock of ideas and examples which could be used 
as the basis of methodologies in this context. 

The most closely related work - apart from Selinger's work on his programming lan- 
guage - is the work by Sanders and Zuliani (?) which develops a guarded command 
language used for developing quantum algorithms. This is a very interesting paper and 
works seriously towards developing a methodology for quantum algorithms. However, 
they use probability and nondeterminism to capture probabilistic aspects of quantum 
algorithms. Ours is an intrinsically quantum framework. The notion of weakest precon- 
dition that we develop here is not related to anything in their framework. There are other 
works (?) - as yet unpublished - in which a quantum dynamic logic is being developed. 
Clearly such work will be related though they use a different notion of pairing. Also the 
work in (?) is related and merits further investigation. Edalat uses the interval domain 
of reals rather than the reals as the values of the entries in his density matrices. This 
seems a good way to deal with uncertainty in the values. 

There is a large literature on probabilistic predicate transformers including several pa- 
pers from the probabilistic systems group at Oxford. A forthcoming book (?) gives an 
expository account of their work. We emphasize again that the theory of probabilistic 
predicate transformers does not capture the proper notions appropriate for the quantum 
setting. Linearity and complete positivity are essential aspects of the theory of quan- 
tum predicate transformers. If one tries to work with probabilistic predicates alone one 
will not be able to express healthiness conditions that capture the physically allowable 
transformations, as the example presented in Sec. |3| illustrates. 

One might worry that the predicates are too restricted. There are many "observables" 
in physics that are not positive; for example, the z-component of angular momentum, 
written J^, for a spin ^ system takes on the values ±i. However, for reasoning about the 
evolution of Jz one can work instead with the operator ^[I + Jz] which has eigenvalues 
J and I and so is a predicate. Of course one cannot do this for unbounded operators like 
the energy, but this will not be a handicap for quantum computation. 

One pleasant aspect of the present work is that it is language independent; though we 
have used it to give the semantics of QPL the weakest precondition formalism stands on 
its own. We can therefore apply it to other computational models that are appearing, for 
example the one-way model (?; ?) for which language ideas are just emerging (?). 
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